Relocating BaseAddress Agnostic Memory Dumps
Often times we need a loaded base address of a memory image that needs to be disk realigned in order to load it and parse the binary successfully in binary analysis tools like IDA or debuggers .
During linking phase the Preferred Base Address
is selected and all absolute addresses are set relative to this particular address .
Relocation table for a PE file consists of following fields
typedef struct _IMAGE_BASE_RELOCATION {
DWORD VirtualAddress;
DWORD SizeOfBlock;
// WORD TypeOffset[1];
} IMAGE_BASE_RELOCATION;
The VirtualAddress
consists virtual offset to a 4kb page where relocations are applied to that page , sizeofblock
is size of 2 byte array consists of offsets to relocation targets in the same page . Base relocation can have multiple relocation entries .
During the image loading process , if the LoadedBase
address is different from preferred base...